Summaryinfo

A vulnerability was found in Apache Tomcat up to 1.2.48. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component mod_jk. The manipulation leads to access control. This vulnerability is known as CVE-2023-41081. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Detailsinfo

A vulnerability was found in Apache Tomcat up to 1.2.48 (Application Server Software). It has been classified as critical. Affected is some unknown processing of the component mod_jk. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue.

The weakness was presented 09/13/2023. The advisory is available at lists.apache.org. This vulnerability is traded as CVE-2023-41081 since 08/22/2023. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 01/15/2025). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 214201 (SUSE SLES15 / openSUSE 15 Security Update : apache2-mod_jk (SUSE-SU-2025:0102-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.2.49 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (214201). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 1.2.17
• 1.2.18
• 1.2.19
• 1.2.20
• 1.2.21
• 1.2.22
• 1.2.23
• 1.2.24
• 1.2.25
• 1.2.26
• 1.2.27
• 1.2.28
• 1.2.29
• 1.2.30
• 1.2.31
• 1.2.32
• 1.2.33
• 1.2.34
• 1.2.35
• 1.2.36
• 1.2.37
• 1.2.38
• 1.2.39
• 1.2.40
• 1.2.41
• 1.2.42
• 1.2.43
• 1.2.44
• 1.2.45
• 1.2.46
• 1.2.47
• 1.2.48

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion